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REDUNDANT INFORMAHON PROCESSING SYSTEM 

BACKGROUND OF THE INVENllON 
(i) Field of the Invention 

[0001] The present invention relates to a redundant information processing 
system, especially to a redundancy information processing system wbich 
comprises three or more processing devices for constituting a redundant 
system (multiple system) to ensure reliability and in which the processing 
devices gen^ate control itrformation by performing predetennined 
infonnation processing based on signals from common signal output means, 
and control a common object of control with the control information which is 
dctranined out of the generated control information by logicaQ decision, far 
example, majority decision, 
(ii) Descriptionof the Related Art 

[0002] As this kind of iiiformation processing system, there is one 
disclosed, for example, in J^anese Patent Application Laid Open No. 9- 
134208, This information processing system comprises three controllers as 
processing devices for indej^ndently processing information on their own 
clock based upon signals from a sensor as common signal output means, and 
an actuator device with an actuator that is the common object of control in 
which a combination of a majority decision logic circuit and a control circuit 
therefore is included. 

[0003] In this information processing system, the three controllers pofonn 
information processing based on signals from the sensor to generate an 
actuator control signal. The result of information processing by the controUdrs , 
is collected and compared in each controller. The results of the comparison in 
each controller are sent to a stwage element of tibie control circuit in the 
actuator device. The control drcuit decides a normal controlla: by majori^ 
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according to comparison result inf ormaticn from each controller* Then, the 
majority decision logic circuit is activated to selectively transimt an actuator 
control signal from the normal controller to the actuator. The actuator is 
thereby operated 

[0004] In sudi conventional infomaation jsocessing systems, however, the 
control circuit for majority decision and the majority decision logic circuit for 
selectavely allowing the actuator control signals to pass based on the majori^ 
decision, which arc in the actuator device, arc parts each being a single fault 
point which keeps the actuator from operating when getting into trouble 
thereof. It has been therefore difficult to ensure sufficient reliability even with 
the controller part multiplied- 

To solve this problem, when the majority decision logic circuit and 
the control circuit that could become the single fault point are composed of 
customized parts with higher reliability than that of the parts on the market, 
the system would cost significantly high. This is especially a crucial point 
when operation of many actuators needs to be controlled* 

SUMMARY OF THE INVENTION 
[0005] An object of the present invention is to provide a redundant 
information processing system which has sufficient reliability without any part 
that could be a single fault point 

To attain this and other objects, the present invention provides a 
redundant information processing system in which three or more processing 
devices perform predetermined information processing based on a signal from 
common signal output means and generate control ioformation, and out of the 
control informationj control information is decided by a logical decision to 
control a common object of control. Each of the three or more processing 
devices comprises a transmission permitting part which is ad^ted to collect 
the results of information processing in tbe process of generating the control 
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information by the three or more processing devices, and to decide by the 
logical decision that the control information generated by which processing 
device is valid; in the case where control information generated by tiie two or 
more processing devices including the relevant processing device among the 
three or more processing devices are made valid, the transmission permitting 
part being adapted to output control information transmitting signal when the 
valid processing device has the highest priority among the processing devices 
with the valid control information according to predetermined priorities or not 
to output the control mfoimation transmitting signal when the valid processing 
device does not have the highest priority, while outputtmg a control 
information blocking signal to the processing devices other than the 
processing devices with valid control information; and in the case where the 
control information generated by the other processing devices except the 
above relevant processing device among the three or more processing devices 
is made valid, the transmission permitting part being adapted not tO output the 
control information transmitting signal and not to output the control 
information blocking signal to the other processing devices. 
[OOOfi] In the infcamation processing system, each of the three or more 
processing devices comprises a transmission permitdng part The 
transmission permitdng part of each processing device collects the results of 
information processing in the process of generating the control information by 
the three or mwe processing devices that compose the system, and decides 
which control information generated by the processiiig devices to be valid 
according to the logical decision; in the case where control information 
gena^ted by more than two of ttie processing devices including therelevant 
processing device among the three or more processing devices is made valid, 
the transmission permitting part outputs a control information transmitting 
signsd when the valid processing device has the highest priority among fte 
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processing devices with the valid control information according to 
predetermined priorities or does not ou^ut the control information 
transmitting signal when the valid processing device does not have the highest 
priority while outputting a control information blocking signal to the 
processing devices other than the processing devices with valid control 
infonnation; and in the case where the control infonnation generated by the 
other processing devices exc^t the above relevant processing device among 
the tfiree or more processing devices is made valid, the transmission 
pemiitting part does not output the control information transmitting signal and 
does not output the control information blocking signal to the other processing 
devices. Note that generated control information or such as computing results 
in the process of generating the control information can be used for the results 
of information processing. 

tOOOT] Furthennore, in the redundant infonnation processing system 
according to the present invention, each of the three or more processing 
devices comprises a logical computing part which is adapted to input the 
control information blocking signal jfirom the other processing devices except 
tfie above relevant processing device among three or more processing devices; 
and in Ae case where the number of inputs of the control information blocking 
signal is less than a predetermined number made valid by the logical decision 
and the transmission permitting part of the processing device outputs the 
control infonnation transmitting signal, tiie logical computing part being 
adapted to output the control infonnation generated by the processing device ' 
to the object of control, and in the case where the number of inputs of the 
control information blocking signal is more than the predetennined number^ 
the logical computing part being adapted not to output control information 
gen^ted by the processing device to the object of control even if the 
transnjission pOTnitting part of the processing device outputs the control 
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ixifonnation transmitting signal. 

[00(^ In the redundant infonnation processing system, each of the three 
or more processing devices that compose the system comprises a transmission 
pennitting part and a logical computing part. The logical computing part of 
each processing device inputs the control information blocking signal from the 
other processing devices except the above relevant processing device among 
the three or more processing devices that compose the system; and in the case 
where the number of inputs of the control information blocking signal is less 
than a predetermined number made valid by the logical decision and the 
transniission permitting part of the processing device outputs the control 
infonnation transmitting signal, the logical computing part outputs the contrcd 
information generated by the processing device to the object of control such as 
an actuator, and in the case where the number of inputs of the control 
information blocking signal is more than the predetermined number, the 
logical computing part does not ou^ut control information generated by tfie 
processing device to the object of control such as au actuator even if the 
transmission permitting part of the processing device outputs the control 
information transmitting signal. 

[OOffi?] According to the information processing system of the present 
invention, even though th^-e is abnormality in the result of the infoimation 
processing in several, which is below the majority, of the three or mc^ 
processing devices that comprise the system, control information generated by 
the two or more processing devices is made valid according to the logical 
decision, for example, the majority decision. This makes it possible to select 
the control infonnation that has been generated normally and to obtain the- 
control infonnation with higher reliability. 

[0010] Furthermore, in tide information jff ocessing device of the present 
invention, while the processing device with the higher priority of the two or 
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more processing devices with valid contrQl information outputs a control 
inf oimation transmitting signal, the processing device not with the higher 
priority of the two or more processing devices with valid control information 
does not output the control infoimation transmitting signal, Moreovear, the two 
or more processing devices that make the control information valid each 
output the control information blocking signal to the other processing devices, 
and so even if the transmission permitting part of the processing devices other 
than the processing devices with valid control information outputs the control 
information because of malfunction, the logic circuit part of the processing 
device inputs the control information blocking signal from beyond the 
predetermined number of the other processing devices that has been made 
vjilid according to the logical decision so as not to output the control 
information. Furthermore, even if the transmission permitting part of the 
plural processing devices other than the processing devices with the valid 
control information ouq)uts the control information because of malfiinctiou, 
the logical computing part of the processing devices with the highest priority 
outputs the control iofomiation to the object of control since the transmission 
permitting part of the of the processing device has output the control 
information transmitting signal, in the case where the number of inputs of the 
control blocking signals is less than the predetennined number that is made 
valid accordng to the logical decision. 

[0011] According to the infoimation processing system of the invention, it 
is possible to output the control infoimation from only a single processing 
device with the higher priority of the two or more processing devices that • 
make the control information valid or that are more probable to function 
normally to the object of control. 

[0012] Moreover, according to the information processing system of the 
invention, the information processing for generating the control information 
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based on the signal from the common signal output means; logical decision 
processing for making the control information valid; selecting processing of 
control information from a plurality of processing devices made valid by the 
logical decision; all are performed in a plurality of processing devices* ITiis 
frees from parts that could become a single fault point such as the majority 
decision logic circuit and its control circuit in the system. It is thereby 
possible to constitute a system with sufficient reliability at a moderate cost. 
[0013] Furthermore, according to the information processing system of the 
invention, the above described processing can be performed regardless of the 
number of the processing devices as Jong as three or more devices are 
provided. This provides high extendibility so that the number of processing 
devices can be increased or decreased in accordance with the demand for 
reliance whereby the demand can easily be met 

[0014] Still further, according to the irrformation processing system of the 
invention, the logical conq)uting part can be constituted by a combination 
circuit without feedback loop, and comprised of logical computing elements. 
This configuration, since the logical computing part does not have a storage 
element, can eliminate the possibility of a Single Event Upset (SEU) where 
the storage element is inverted by the influence of cosmic radiation or iHc like 
as to the logical computing part, when applied to the attitude control of a 
rocket or an artificial satellite in space. It is thereby possible to effectively 
prevent the result determined by the transmission permitting part according to 
the majority decision from being in vain because of the malfunction of fte . 
logical computing part caused by the SEU. 

[0015] Further yet, according to the information processing system of the 
invention, in the case where the processing device uses past control 
information in the process of generating the control information, the 
processing device other than the processing devices that make the control 
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mfoimation valid can rewrite the generated control information to the control 
infonnation of the processing device that xnake the control information valid 
and use the rewritten control infonnation for the next process of generating the 
control infonnation. This configuration, when the transmission permitting 
part temporarily malfunctions because of the SEU, can abandon the incorrect 
processing result at the time of malfunction and use the control information 
generated in other normal processing device, thereby resulting in the 
improvement of the reliability of the system. 

[0016] Further yet, according to the information processing system of the 
invention, the processing procedures of the logical decision made by the 
transmission permitting parts of the three or more processing devices can be 
the same. This configuration can reduce the operational errors made by the 
operator when developing programs for performing the logical decision or 
installing the programs in the system, thereby resulting in the improvement of 
the reliability of the system. 

Other objects and advantage of the present invention will become more 
apparent from the following detailed description taken in conjunction with the 
appended claims. 

BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a structural view showing the configuration of one 
embodiment of the redundant information processing system acccwding to the 
present invention; 

FIG, 2 is a structural view showing the circuitry of interface circuits 
of each processing device in the redundant information processing system in 
the embodiment; 

FIG. 3 is a structural view showing the state of interconnection 
among processor parts and among interface circuits of three processing 
devices, and between processor part and interface circuit of each processing 
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device; 

FIG. 4 is a flowchart showing majority decision algorithm as one 
example of a logical decision performed according to a program in a memory 
of the processor part by a CPU of a processor part in a processiag device 1 A in 
the redundant information processing system in the above embodiment; 

FIG. 5 is a flowchart showing majority decision algorithm as one 
example of a logical decision pCTfonned according to a program in a memory 
of the processor part by a CPU of a processor part in a processing device IB in 
the redundant information processing system in the abofve embodiment; 

FIG, 6 is a flowchart showing majority decision algorithm as one 
example of a logic£il decision performed according to a program in a memory 
of the processor part by a CPU of a processor part in a processing device IC in 
the redundant information processing system in the above embodiment; 

FIG, 7 is a flowchart showing command verification algorithm 
perfonned by the processor part of the processing device 1 A in the redundant 
information processing system in the above embodiment; 

FIG. 8 is a flowchart showing command verification algorithm 
performed by the processor part of the processing device IB in the redundant 
information processing system in the above embodiment; and 

HG. 9 is a flowchart showing command verification algorithm 
I)crformed by the processor part of the processing device IC in the redundatit 
information processing system in the above embodiment 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
[0017] Anembodimentof the present invention will hereinafter be; , 
described in detail with reference to the accompanying drawings: 

FIG. 1 is a structural view showing one embodiment of the 
redundant information processing system according to the present invention; 
reference numbers 1 A to IC denote processing devices all comprising the 
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same configuration, 2 processor parts as transniission permitting parts, 3 
interface parts as logical computing parts, 4 a sensor as signal ou^ut means 
common to the processing devices lA to IC, 5 an actuator as a coranaon 
control object for the processing devices 1 A to IC, and 6 a network which 
interconnects the processing devices 1 A to IC, The redundant information 
processing system according to this embodiment can be applied, for example, 
to the attitude control system of a rocket 

[0018] The processing devices 1 A to IC here comprise, more specifically, 
processor parts 2 and interface parts 3 respectively. The processor parts 2 
comprise central processmg units (CPU) 2a for computing processing, 
memories (MEM) 2b for Storing information of programs or computing results 
and having the CPU execute computing processing based on a predetermined 
program, clock circuits (CLK) 2c for supplying a clock signal with the CPUs 
2a and memories 2b, and network controllers (NC) 2d for controlling the 
exchange of information between the CPUs 2a and the memories 2b and a 
network 6. Note that each of the clock circuits 2c of fee processor parts 2 in 
the three processing devices 1 A to IC in the system according to this 
embodiment operates independently* 

10019] Purthermore, the interface parts 3 comprise interface circuits (I/O) 
3a connected to the sensor 4 for inputting an ou^ut signal from the sensor 4, 
interface circuits (I/O) 3b connected to the actuator 5 for outputting a 
command signal described later as control infomation to the actuator 5. 
[0020] HG. 2 is a structural view showing the circuitry of the interface 
circuits 3b of each of the processing devices lA to IC. The interface circuits 
3b here comprise a logic circuit for controlling the output of the conmaand 
signal, which composes, as logical computing elements, an AND element 3c, a 
NAND element 3d and a gate element 3e, and a signal circuits 3f for directty 
outputting blocking signals SI, S2 described later as control blocking signals 
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output by the processor parts 2 of the processing devices that have the 
interface circuits 3b to the interface circuits 3b of the other two processing 
devices, 

[0021] In the above logic circuit, the NAND element 3d outputs a signal 
•*0" when signals "1" as blocking signals SI, S2 are input at the same thne 
from the interface circuits 3b of the two other processing devices, and outputs 
a signal "1" when a signal "I" is not input from at least one of the processing 
devices. Moreover, the AND element 3c outputs a signal "1" when a signal 
"1" is input from the NAND element 3d at the same time as a signal "1" as a 
command transmitting signal, which is described later as a control information 
transmitting signal from the processor parts 2 of the processing devices, is 
input. When at least either of a signal "1" as command transmitting signal or a 
signal "1" from the NAND element 3d is not input, the AND element 3c 
outputs a signal "0". When a signal "1" is input from the AND element 3c, the 
gate element 3e outputs a cormnand signal to the actuator 5 when the 
command signal is input from the processor parts 2 of the processing devices. 
The gate element 3e further outputs the command signal as a command 
verification signal for command verification algorithm, which is described 
later, to the processor parts 2 of the processing devices 2, but when a signal 
"1" is not input from the AND clement 3c, does not output to the actuator 5 
and blocks the command signal even if the command signal is input from the 
processor parts 2 of the processing devices. 

[0022] HG. 3 is a structural view showing the state of interconnection . 
among the processor parts 2 of the processing devices lA to IC and among the 
interface circuits 3b, and between the processor part 2 and the interface cfrcuit 
3b of each of the processing devices 1 A to IC. In this embodiment, by 
connecting as shown in the figure, the signal circuit 3f of the processor part 2 
in each of the processing devices lA to IC outputs the blocking signals Si, S2 
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to the intaf ace circuits 3b of the two oth^ processing devices. 
10023] According to the information processing system of this 
embodiment, when the identical signal is output from the sensor 4 as the 
common signal output means to the three processing devices lA to IC, the 
CPUs 2a of the processor parts in the three processing devices 1 A to IC first 
perform in parallel predetennined computing processing based on the signal 
from the sensor 4 in accordance with a given program in the memcnics 2b of 
the processor pans 2. Then the CPUs generate command signals to control the 
operation of the actuator 5 that is the common object of control, and inputs the 
result of the information processing peifoimed by the other processing devices 
among the three processing devices 1 A to IC through the network 6 in order 
to perform the following majority decision proc^sing. 
[0024] The result of information processing to be input includes a 
predetermined part (first several bits, for example) of the generated command 
signaL Instead of the conamand signal, it is possible to apply the ruiming 
amount of the actuator or all or predetermined part of the computing result in 
the process of generating the conamand signal. Moreover, in this embodiment, 
the three processing devices 1 A to IC are previously prioritized; the 
processing device lA with the highest priority, the processing device IB with 
the next highest priority and the processing device IC with the lowest priority. 
In the case where the results of the informadon processing among the 
processing devices 1 A to IC do not correspond at all, it has been set to ouq>ut 
the command signal of the processing device lA that has the highest priority. 
iW2S} FIGt 4 is a flowchart showing the majority decision algoritibm as 
one example of the logical decision perfonned by the CPU 2a of the processor 
part 2 on the processing device 1 A according to a program in the memory 2b 
of the processor part 2. Here, the bloctdng signal S 1 is output to the interface 
circuit 3b of the processing device IC to control the processing device IC, an^ 
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the blocking signal S2 is output to the interface circmt 3b of the processing 
device IB to control the processing device IB. 

[0026] Step 1 1 in FIG. 4 comprises comparing the result of the information 
processing by the CPU 2a of the processing device 1 A itself with that by the 
processing device IB that is one of the other processing devices and judging 
the correspondence between the two. When they correspond, step 12 follows. 
When not correspond, step 15 follows. Next, step 12 comprises comparing the 
result of the information processing by the CPU 2a of the processing device 
1 A itself with that by the processing device IC that is the other one of the 
Other processing devices and judging the correspondence between the two. 
When they correspond, step 13 follows. When not correspond (This includes 
the case where the result is not input because of the breakdown of the 
processing device IC, The following case where two do not correspond 
includes the case the result is not input because of the breakdown of one of the 
processing devices), step 14 follows. Since all the results of the information 
processing of the three processing devices 1 A to IC correspond according to 
the judgment* made at steps 11 and 12, following step 13 comprises setting the 
command transmitting signal for a signal "1" so that the processing device 1 A 
with the highest priority may send the conunand signal* Step 13 also 
comprises setting the blocking signals SI and S2 for signals "0" (no blocking 
signal) since the other processing devices IB and IC are also correct. 
[0027] On the other hand^ step 14 comprises determining that the results of 
information processing by the processing devices 1 A and IB are correct 
accor^g to the logical decision, for example decision by majority, since the* 
results of the processing devices 1 A and IB correspond but those of the 
processing devices lA and IC do not correspond according to the judgment at 
steps 1 1 and 12, In this case, step 14 further comprises setting the conunand : 
transmitting signal for a signal " 1 " so that the jHrocessing device 1 A with the " 
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highest priority may send the command signal, and also compri.5es setting the 
blocking signal SI directed to the processing device IC for a signal "1" 
(blocking signal Yes) since the processing device IC is incorrect, and setting 
the blocking signal S2 directed to the processing device IB for a signal "0" 
since the processing device IB is correct 

[0028] Furthermore, in the same way as step 12, step 15 comprises 
comparing the result of the information processing by the CPU 2a of the 
processing device 1 A itself with that by the processing device IC that is the 
other one of the othear processing devices and judging the correspondence 
between the two. When they correspond, step 16 follows. When not 
correspond, step 17 follows. Step 16 comprises determining that the results of 
it)fonnation processing by the processing devices 1 A and IC are correct 
according to the logical decision, for example decision by majority, since flie 
results of the processing devices 1 A and IC correspond but those of the 
processing devices lA and IB do not correspond according to the judgment at 
steps 1 1 and 15. In this case, step 16 further comprises setting the command 
transmitting signsd for a signal " I" so that the processmg device 1 A with the 
highest priority may send the command signal, and also comprises setting the 
blocking signal SI directed to the processing device IC for a signal "0" since 
the processmg device IC is correct, and setting the blocking signal S2 directed 
to the processing device IB for a signal "1" since the processing device IB is 
incorrect. 

[0029] On the other hand, step 17 further comprises comparing the results 
of the information processing of the two processing devices IB and IC and 
judging the correspondence between the two. When they coaespond, step 18 
follows- When not correspond, step 20 follows. St^ 18 comprises 
determining that the results of information processing by the processing 
devices IB and IC are conrect according to the logical decision, for example. 
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decision by majority, since the results of the processing devices IB and IC 
correspond but neither those of the processing devices 1 A and IB nor those of 
the processing devices lA and IC correspond according to the judgment at 
steps 11, 15 and 17. In this case, step 18 furth^ comprises setting the 
command transmitting signal for a signal ''0" so that the processing device IB 
with the highest prioriiy may send the command signal, and also comprises 
setting the blocking signals SI and S2 for a signal "0'' since the processing 
devices IB and IC are coirect. After this, step 19 comprises replacing data on 
the result of the information processing in the memory 2b of the processor part 
2 of the processing device 1 A with data on the result of the information 
processing from the other processing devices IB and IC- 
[0^] When all the results of Che information processing of the three 
processing devices 1 A to IC do not correspond according to the judgment 
made at the precedent steps 11,15 and 17, Ais makes it impossible to 
determine by the logical decision, for example, m^ority decision^ Tberrfbjre, 
according to the aforementioned rule as to this embodiment, step 20 comprises 
setting the command transmitting signal for a signal "1" so that the processing 
device 1 A that has the highest priority among the Arcc processing devices 
may send the command signal, and also setting the blocking signals SI and S2 
for a signal "I'* since both the processing devices IB and IC are incorrect 
[0Q9X1 FIG. 5 is a flowchart showing the majority decision algorithm as 
one example of a logical decision performed by the CPU 2a of the processor 
part 2 of the processing device IB according to a program in the memory 2i> 
of the processor part 2. Here, the blocking signal SI is output to the interface 
drcuit 3b of the processing device 1 A to control the processing device 1 A, and 
the blocking signal S2 is output to the interface cJrcuit 3b of the processing : 
device IC to control the processing device IC. 

[0032] Step 21 in FIG* 5 comprises comparing the result of the information 
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processing by the CPU 2a of the processing device IB itself with that by the 
processing device 1 A that is one of the other processing devices and judging 
the correspondence between the two. When they correspond, step 22 follows. 
When not correspond, step 25 follows. Next, step 22 comprises comparing the 
result of the information processing by the CPU 2a of the processing device 
IB itself with that by the processing device IC that is the other one of the 
other processing devices and judging the correspondence between the two. 
When they correspond, step 23 follows. When not correspond^ step 24 
follows. Since all the results of the information processing of the three 
processing devices lA to IC correspond according to the judgment made at 
steps 21 and 22, following step 23 comprises setting the command 
transmitting signal for a signal "0" so that the other processing device 1 A with 
the highest priority can send the command signal. Step 23 also comprises 
setting the blocking signals SI and S2 for a signal "0" (no blocking signal) 
since the other processing devices lA and IC are also correct 
[0033] On the other hand, step 24 comprises determining that the results of 
information processing by the processing devices 1 A and IB arc correct 
according to the logical decision, for example decision by majority, since tfee 
results of the processing devices 1 A and IB correspond but those of the 
processing devices IB and IC do not correspond according to the judgment at 
steps 21 and 22. In this case, step 24 further comprises setting the conomand 
transmitting signal for a signal "0" so that the other processing device 1 A with 
the highest priority can send the command signal, and also comprises setting 
the blocking signal S2 directed to the processing device IC for a signal "1" 
(blocking signal* Yes) since the processing device IC is incorrect, and setting 
the blocking signal SI directed to the processing device lA for a signal "0" 
since the processing device 1 A is correct 

£0034] Furthmnore, in the same way as step 22, step 25 comprises 
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comparing the result of the iirfoimation processing by the CPU 2a of the 
processing device IB itself with that by the processing device IC that is the 
other one of the other processing devices and judging the correspondence 
between the two. When they correspond, step 26 follows. When not 
correspond, step 27 follows. Step 26 comprises detennining that the results of 
information processing by the processing devices IB and IC are correct 
according to the logical decision, for example decision by majority, since the 
results of the processing devices IB and IC correspond but those of the 
processing devices 1 A and IB do not correspond according to the judgment at 
steps 21 and 25. In this case, step 26 further conaprises setting the command 
transroitting signal for a signal "1 " so that the processing device IB with the 
highest piority may send the command signal, and also comprises setting the 
blocking signal SI directed to die processing device lA for a signal "1" since 
the processing device 1 A is incorrect, and setting the blocking signal S2 
directed to the processing device IC for a signal "0" since the processing 
device IC is correct 

[0035] On the other hand, step 27 further comprises comparing the results 
of the information processing of the two processing devices 1 A and IC and 
judging the cognrespondence between the two. When they correspond, step 28 
follows* When not correspond, step 30 follows. Step 28 comprises 
detennining that the results of information prcxsessing by the processing 
devices 1 A and IC are correct according to the logical decision, for example, 
decision by majority, since the results of the processing devices 1 A and IC 
correspond but neither those of the processing devices 1 A and IB nor those of 
the processing devices IB and IC correspond according to the judgment at 
steps 21, 25 and 27. In this case, step 28 further comprises setting the 
command transmitting signal for a signal "0" so that the processing device I A 
with the highest priority may send the command signal, and also comprises 
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setdng the blocking signals SI and S2 for a signal "0" since the processing 
devices lA and IC are correct After this, step 29 comprises replacing data on 
the rcstilt of the information processing in the memory 2b of the processor part 
2 of the processing device IB with data on the result of the information 
processing from the other processing devices lA and IC. 
[0036] When all the results of the information processing of the three 
processing devices lA to IC do not correspond according to the judgment 
made at precedent steps 21, 25 and 27, this makes it impossible to determine 
by the logical decision, for example, majority decision. Therefore, according 
to the aforementioned rule as to this embodiment, step 30 comprises setting 
the command transmitting signal for a signal "0" and setting the blocking 
signal SI directed to the processing device 1 A for a signal "0" so that the 
processing device 1 A that has the highest priority among the tiiree processing 
devices can send the command signal, and also setting the blocking signal S2 
directed to the processing device IC for a signal "1" since the processing 
device IC is incorrect. 

[0037] HG. 6 is a flowchart shoving the majority decision algorithm as 
one example of a logical decision performed by the CPU 2a of the processor 
part 2 of the processing device IC according to a program in the memory 2b 
of the processor part 2. Here, the blocking signal SI is output to the interface, 
circuit 3b of the processing device IB to control the processing device IB, and 
the blocking signal S2 is output to the interface circuit 3b of the processing 
device lA to control the processing device 1 A, 

[0038] Step 3 1 in HG. 6 comprises comparing the result of the inf OTmation 
processing by the CPU 2a of the processing device IC itself with that by the 
processing device 1 A that is one of the other processing devices and judging 
the correspondence between the two. When they correspond, step 32 follows/ 
When not correspond, step 35 follows. Next, step 32 comprises comparing the 
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result of the infonnatioii processing by the CPU 2a of the processing device 
IC itself with that by the processing device IB that is the other one of the 
othCT processing devices and judging the correspondence between the two. 
When they correspond, step 33 follows. When not correspond, step 34 
follows. Smce all the results of the information processing of the three 
processing devices 1 A to IC correspond according to the judgment made at 
steps 31 and 32, following step 33 comprises setting the conunand 
transmitting signal for a signal "0" so that the other processing device 1 A with 
the highest priority can send the command signal* Step 33 also comprises 
setting the blocking signals SI and S2 for a signal "0" (no blocking signal) 
since the other processing devices 1 A and IC are also correct 
[0039] On the other hand, step 34 comprises determining that the results of 
information processing by the processing devices 1 A and IC are correct 
according to the logical decision, for example decision by majority, since the 
results of the processing devices lA and IC correspond but those of the 
processing devices IB and IC do not correspond according to the judgment at 
steps 31 and 32. In this case, step 34 further comprises setting the command 
transmittmg signal for a signal "0" so that the other processing device 1 A with 
the highest priority can send the command signal, and also comprises setting 
the blocking signal SI directed to the processmg device IB for a signal "1" 
(blocking signal Yes) since the processing device IB is incorrect, and setting 
the blocking signal S2 directed to the processing device 1 A for a signal "0" 
since the processing device 1 A is correct 

[0040] Furth^more, in the same way as step 32, step 35 comprises 
comparing the result of the information processing by flie CPU 2a of the 
processing device IC itself with that by the processing device IB that is the 
other one of the othca* processing devices and judging the correspondence 
between the two. When they correspond, step 36 follows. When not, step 37 
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follows. Step 36 comprises deterauiaing that the results of informaticii 
processing by the processing devices IB and IC are correct according to the 
logical decision, for example decision by majority, since the results of the 
processing devices IB and IC correspond but those of the processing devices 
1 A and IC do not correspond according to the judgment at steps 31 and 35. In 
this case, step 36 fiKther comprises setting the command transmitting signal 
for a signal "0" so that the other processing device IB with the highest priority 
can send the command signal* and also comprises setting the blocking signal 
SI directed to the processing device IB for a signal "0" since the processing 
device IB is correct, and setting the blocking signal 82 directed to the 
processing device 1 A for a signal "F since the processing device 1 A is 
incorrect. 

[0041] On the other band, step 37 further comprises comparing the results 
of the information processing of the two processing devices 1 A and IB and 
judging the correspondence between the two. When they correspond, step 38 
follows. When not correspond, step 40 follows. Step 38 comprises 
determining that the results of information processing by the processmg 
devices 1 A and IB are correct according to the logical decision, for example, 
decision by majority, since the results of ihe processing devices lA and IB 
correspond but neither those of the processing devices lA and IC nor those of 
the processing devices IB and IC correspond according to ttie judgment at - 
steps 31, 35 and 37. In this case, step 38 further comprises settir^ the 
command transmitting signal for a signal "0" so that the processing device 1 A 
with the highest priority can send the command signal, and also comprises 
setting the blocking signals SI and S2 for signals "0" sinws the processing 
devices lA and IB are correct After this, step 39 comprises repladng data on 
the result of the information processing in ttie memory 2b of the processor p^ 
2 of the processing device IC with data on the result of the information 



00133 (2000-118,083) 



-21- 



processmg from the other pfrocessing devices 1 A and IB. 
[0042] When all the results of the information processing of the three 
processing devices 1 A to IC do not correspond according to the judguoent 
made at precedent steps 31, 35 and 37, this makes it impossible to determine 
by the logical decision, for example, majority decision. Therefore, according 
to the aforementioned rule as to this embodiment, step 40 comprises setting 
the command transmitting signal for a signal "0" and setting the blocking 
signal S2 directed to the processing device 1 A for a signal "0" so that the 
processing device 1 A that has the highest priority among the three processing 
devices can send the command signal, and also setting the blocking signal SI 
directed to the processing device IB for a signal "1" since the processing 
device IB is incorrect, 

[0043] In this way, according to the foregoing embodiment, the processor 
parts 2 of the processing devices lA to IC perform parallel processings When 
the processor part 2 judge itself to be correct and be allowed to transmit a 
conomand transmitting signal according to the logical decision, for example, 
majority decision and priority, it ou^uts a signal "1" as the command 
transmitting signal to the interface circuit 3b of tibe processing device. When 
the processor part 2 judges the result of information processing of the other 
processing device to be incorrect, it transmits a blocking signal to the interface 
3b of that processing device except when being unable to judge by the logical 
decision, for example, the majority decision. As a result, as shown in the 
diagram 1 below, when the processing devices 1 A to IC correspond, when 
only the processing devices 1 A and IB correspond and when only the 
processing devices lA and IC correspond, the processing device 1 A outputs a 
command signal to the actuator 5 via the interface 3b. When only the 
processing devices IB and IC correspond* the processing device IB outputs a 
command signal to the actuator 5 via the interface 3b. When all the 
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processing devices lA to IC do not correspond, following an operational 
demand, that is, the processing device with the highest priority is required to 
output a command signal, the processing device 1 A outputs the command 
signal to the actuator 5. Moreover, when all the processing devices lA to IC 
do not correspond, it is also possible to make an operational demand not to 
allow any of the processing devices to output conraiands and to send an error 
warning signal to the user of the system. 
[0044] 
[diagram 1] 
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The blank mark (O) indicates the processing device of which the result of 
inforaiation processing corresponds. 

[0045] In the infonnatioii processing system according to this embodiment, 
followiag command verification algorithm is executed This computing 
processing handles the case where a command signal is not properly output 
because of tlic abnormality in the interface circuits 3 while proper information 
processing is performed in the processor parts 2. FIGs. 7 to 9 are flowcharts ' 
showing the command verification algorithm which the processor parts 2 of 
the processing devices lA to IC execute. 

[0046] As shown in step 41 of FIG* 7, the processor part 2 of the 
processing device I A with the highest priority does not operate. As shown in 
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HIG. 8, at step 42, the processor part 2 of the processing device IB with the 
next highest priority judges whether a coirea command signal is sent from 
any of the interface circuits 3 to the actuator 5 based on, for example, a first 
part of the command signal sent back as a command verification signal from a 
circuit connected to the actuator. When a correct command signal is sent, step 
43 follows and no operation is made- When a correct conmiand signal is not 
sent, the processor part 2 judges whether the processing device 1 A should 
have sent an actuation command signal to the actuator 5 at step 44. In the case 
where the processing devices other than the processing device 1 A should have 
sent the actuation command signal, step 43 follows. In toe case where the 
processing device lA should have sent the actuation command signal, the 
processor part 2 sets a command transmitting signal for a signal "1" for the 
processing device IB to send a command signal, and sets the blocking signal 
SI directed to the processing device 1 A for a signal "1" and keeps state of the 
blocking signal S2 directed to the processing device IC as it is at step 45. 
[0047] Furthermore, as shown in FIG. 9, at step 46, the processor pari 2 of 
the processing device IC with the lowest priority judges whether a correct 
command signal is sent from any of the interface circuits 3 to the actuator 5 
based on, for example, a first part of the command signal sent back as a 
command verification signal from the circuit connected to the actuator. When 
a correct command signal is sent, step 47 follows and no operation is made. 
When a correct command signal is not sent, the processor part 2 judges 
whether the processing device 1 A should have sent an actuation command 
signal to the actuator 5 at step 48. In the case where the processing device 1 A 
should have sent the actuation command signal, the processor part 2 judges 
whether the processing device IB is normal at step 49. 
[004S] At step 49, when the processor part 2 judges that the processing 
device IB is normal, it makes no operation and when judges that the 
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processing device IB is not noraxal, it proceeds to step 50. Also when other 
than the processing device lA, which is the processing device IB shoiild have 
sent a command signal at the step 48, it also proceeds to the step 50. At the 
step 50, a command transmitting signal is set for a signal "1 " such that the 
processing device IC sends a command signal, and the blocking signal SI 
directed to the processing device IB is set for a signal "1", and the state of the 
blocking signal S2 directed to the processing device 1 A is kept as it is. 
[0049] According to the command verification algorithm, when a 
command signal is not at all sent or an incoirect command signal is sent 
because of the abnormality in the interface circuit 3 of the processing device 
1 A which should send a command signal, of the processing devices lA and IB 
whose processor parts 2 are normal, the processing device IB immediately 
blocks the output of the command signal of the processing device 1 A and 
sends a correct conxmand signal so that the operation of the actuator 5 is 
properly controlled Moreover, when the processing device 1 A can not output 
a command signal because of the abnonnali^ in the interface circuit 3 of the 
processing device 1 A, while a command signal is not at all sent or an incorrect 
command signal is sent because of the abnormality in the interface circuit 3 of 
the processing device IB, the processing device IC immediately blocks the 
ou^ut of the command signal of the processing device IB and sends a correct 
command signal so that the operation of the acmator 5 is propcarly controlled. 
[0050] According to the information processing system of this 
embodiment, even though there is abnormality in the result of the information 
processing in several, which is below the majority, of three processing devices 
1 A to IC that comprise the system, control information generated by the two 
or more processing devices is made valid according to the logical decision, for 
example, the majority decisioiL This makes it possible to select the coiitrol 
information that has been generated normally and to obtain the control 
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infonnation with higher reliability. 

[0051] Moreover, accarding to the ixiformation processing system of this 
embodiment, a command signal can be sent from a single processing device 
only with the higher priority out of the two or more j^ocessing devices with 
valid command signals, that is, the processing devices that are higWy likely to 
operate normally, to the object of control. This can prevent the difficulty in 
operating the actuator 5 due to the overlapping or striking of plural command 
signals. 

[0052] Moreover, according to the information processing system of this 
embodiment, the information processing for generating a command signal 
based on the signal from the sensor 4; logical decision, for example, the 
majority decision processing for making the command signal valid; selecting 
processing of command signal from a plurality of processing devices made 
valid by the logical decision; all are performed in the three i^occssing devices 
1 A to IC, This frees from parts that could become a single fault point such as 
the majority decision logic circuit and its control circuit in the system. It is 
thereby possible to consDtutc a system with sufficient reliability at a moderate 
cost 

[0053] Furthermore, according to the information processing systein of this 
embodiment, the above described processing can be performed regardless of 
the number of the processing devices as long as the number is not reduced. 
This provides high extendibility so that the number of processing devices can 
be increased in accordance with the demand for reliance whereby the demand 
can easily be met. 

[0054] Still further, according to the information processing system of this 
embodiment, the interface circuits 3 are constituted by logical computing 
elements and comprised of a combination circuit without feedback loop and 
has no storage element, possibility of a Single Event Upset (SEU) where the 
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storage element is inverted by the influence of cosmic radiation or the like can 
be eliminated as to the logical computing part, when applied to tfie attitude 
control of a rocket or an artificial satellite in space. It is thereby possible to 
effectively prevent the result detennined by the processor parts 2 according to 
the logical decision, for example, majority decision from being in vain 
because of the malfunction of the logical computing part caused by the SEU. 
[0055] Further yet, according to the information processing system of this 
embodiment, in the case where the processing devices 1 A to IC use past 
control information in the process of generating the command signal, the 
processing device other than the processing devices with the valid command 
signals abandons the generated command signal and replaces it with a 
command signal of the processing device with the valid command signal at the 
precedent steps 19, 29 and 39. This can prevent temporary errors sucb as an 
inversion error of the storage element caused by such as raidiation from further 
continuing, thereby resulting in the improvement of the reliability of the 
system. 

[005Q Further yet, according to the information processing system of this 
embodiment, as shown in FIGs 4 to 6, the processing prpcediires of the logical 
decision, for example, the majority decision made by the processor paits 2 of 
the three processing devices 1 A to IC are the same. This can reduce the 
operational otots made by the op^ator when developing programs for 
performing the logical decision or installing the programs in the system, 
thereby resulting in the improvement of the reliability of the system. 
[0057] The description has been ^ven according to the embodiment 
However, the present invention is not limited to the foregoing embodiment 
For example, the number of processing devices can be suitably chosen with 
three or more devices which can adopt, for example, Ae majority decision 
(that is, it is possible to select the result of information processing of the 
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greater number of processing devices whose results of information processing 
are the same). In the case where the number is fouTj for example, when the 
results of information processing of two processing devices correspond, those 
processing devices are correct. And when each two of the processing devices 
has the same result information processing respectively, the processing 
devices for outputting the control information can be decided based on the 
priority. Further^ the signal output means is not limited to the sensor 4, and 
the object of control is not limited to the actuator 5 cittier. 

The preferred embodiments described herein arc therefore 
illustrative and not restrictive, the scope of the invention being indicated by 
the appended claims and all variations which come within the meaning of the 
claims are intended to be embraced therein. 
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